CVE Vulnerability Catalog

A vulnerability in the Linux kernel RDMA/ucma module: ucma_write_cm_event() does not take the handler lock. While ucma_migrate_id() moves a context to another file, ctx->file can be swapped mid-sequence, causing list corruption, a permanently held mutex, and a process stuck in D state. The flaw is reachable by an unprivileged user via /dev/infiniband/rdma_cm.

In the Linux kernel, the RDMA/uverbs subsystem's UVERBS_METHOD_REG_MR method is missing the UVERBS_ATTR_UHW attribute, even though three drivers (mthca, irdma, siw) have UHW data associated with reg_mr and assume udata cannot be NULL. A malicious userspace process can trigger a NULL udata crash in those drivers.

In the Linux kernel, the RDMA/uverbs subsystem's legacy write() path passes a uverbs_attr_bundle to provider code without an ioctl method element. If malformed provider input causes the common validation code to emit an error message, uverbs_get_handler_fn() dereferences the uninitialized method_elm pointer.

In the Linux kernel's as3722_get_regulator_dt_data(), of_get_child_by_name() acquires a reference on np which is assigned to pdev->dev.of_node, but of_node_put(np) is then called immediately, releasing the reference and leaving a dangling pointer. Removing the of_node_put(np) call lets the device hold the reference.

In the Linux kernel ring-buffer subsystem, ring_buffer_alloc_read_page() races with ring_buffer_subbuf_order_set, potentially allocating a reader page with an outdated order. If subbuf_order changes mid-allocation, bpage->order may not match the actual allocated memory.

In the Linux kernel ring-buffer subsystem, when sub-buffers use an order greater than 0, cpu_buffer->free_page is allocated with subbuf_order. The fix ensures the correct order is used for cpu_buffer->free_page.

In the Linux kernel ring-buffer subsystem, ring_buffer_subbuf_order_set() can clear cpu_buffer->free_page, causing races with ring_buffer_alloc_read_page() and ring_buffer_free_read_page(). The fix holds cpu_buffer->lock while resizing a subbuf.

In the Linux kernel ring-buffer subsystem, discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuf_order for free_pages(), potentially crashing the kernel or leaking memory. The fix stores the actual page order alongside the page address by making free_page a buffer_data_read_page.

In the Linux kernel ring-buffer subsystem, __rb_get_reader_page_from_remote() continues despite a failed swap_reader_page callback (returning -EBUSY), potentially mishandling the page list. The fix treats the callback failure as recoverable, logs it with pr_warn_ratelimited(), and returns NULL.

In the Linux kernel orangefs filesystem, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails but does not clear the pointer before goto Efault. This causes a deterministic double-free on the readdir side when a client sends a downcall with trailer_size exceeding the supplied bytes.

In the Linux kernel orangefs filesystem, orangefs_prepare_cdm_array() sizes each client debug keyword buffer with strcspn(cds_head, " ") but parses it with %s, which skips leading whitespace. If a client debug entry starts with a space, the allocation can be too small and sscanf() writes past the buffer.

In the Linux kernel, the ocfs2 filesystem has a memory leak during copy-on-write operations triggered by copy_file_range() within the same filesystem. The issue was found by fuzzing and occurs because deallocations are not always run on copy-on-write completion, leading to unreferenced memory allocations.

In the Linux kernel's ocfs2 (o2dlm) subsystem, the DLM_MIGRATE_REQUEST handler trusted the peer-supplied name length (namelen) without bounding it. dlm_init_mle() then copied that many bytes into the fixed 32-byte mname[] array of an o2dlm_mle slab object, allowing a heap out-of-bounds write of up to ~215 attacker-controlled bytes.

In the Linux kernel, the ocfs2 dlm_mig_lockres_handler trusted the num_locks and lockname_len fields from a DLM_MIG_LOCKRES message without validation. This led to an out-of-bounds read (BUG_ON panic) and a heap out-of-bounds write when copying the lock name into a fixed 32-byte object. Any node in the domain could trigger this.

The Linux kernel ocfs2 module lacked validation of the rl_used and rl_count fields in the refcount block. A crafted or corrupted ocfs2 image with rl_used set to 0xffff causes an out-of-bounds read past the metadata block and a subsequent out-of-bounds memmove during a reflink (FICLONE) operation. Exploitation requires local access (CAP_SYS_ADMIN mounting a crafted image or raw write to the backing block device).

A vulnerability was found in the Linux kernel's ocfs2 module due to missing validation of directory-index entry counts when reading metadata. The functions ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() do not bound the de_num_used and de_count fields against the block capacity, allowing a crafted on-disk image to set them to 0xffff and cause an out-of-bounds read past the 4KB metadata block. The flaw is reachable from any path lookup, stat() or open() on an indexed directory once the image is mounted.

A vulnerability was fixed in the Linux kernel's ocfs2/cluster module, in the o2hb_region_pin() function. The function was called while holding the o2hb_live_lock spinlock but invoked the sleeping configfs_depend_item() function, triggering a BUG under CONFIG_DEBUG_ATOMIC_SLEEP, causing a lock order inversion leading to deadlock, and leaking the o2hb_dependent_users counter on partial pinning failure.

In the Linux kernel, the ocfs2 function ocfs2_dir_foreach_blk_el() on 32-bit kernels incorrectly computed the directory position mask, clearing the high 32 bits of the position. When readdir() crossed the 4 GiB boundary, the position was reset, causing infinite re-enumeration of already-returned directory entries.

In the Linux kernel on the OpenRISC architecture, the sys_or1k_atomic syscall (number 244) did not check user pointers with access_ok() before performing an atomic swap in hand-written assembly. This allowed an unprivileged process to pass a kernel address and directly read from or write to kernel memory.

In the Linux kernel, the openvswitch module has a use-after-free in CT limit teardown. The CT limit pointer was not removed from readers nor protected by an RCU grace period, so packet processing could dereference freed state when the network namespace is torn down. An unprivileged user can trigger this from a user and network namespace.